Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c72eccee997e5f1…

MALICIOUS

PDF

40.0 KB Created: 2020-03-19 04:05:56 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b8c9c44aa517ec1c4dd478f1e2acff53 SHA-1: b5a210074c07d8299b70deefa940eaaa4eb686d4 SHA-256: 4c72eccee997e5f12d3c7624cfb28bd60d634d30760bca3997a972e1c3c7f725
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links to other PDFs hosted on various domains, indicative of a link farm or SEO abuse tactic. The ML classifier strongly flagged this PDF as malicious. The primary attack pattern involves directing users to a network of seemingly unrelated PDF documents, likely to obscure malicious activity or for SEO manipulation.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://4angelstshirts.com/uploads/1/3/0/2/130272415/130272415.html#boats+in+d+day
    • http://climatesmartlending.org/uploads/1/3/0/6/130621592/9022144.pdf
    • http://marquitalopez.com/uploads/1/3/0/6/130639023/bezinulo_turajojikuwadil_givuvolilun.pdf
    • http://slccabroad.com/uploads/1/3/0/5/130546742/jepenovup.pdf
    • http://platteparkchurch.org/uploads/1/3/0/5/130542953/8874841.pdf
    • http://hostmaster.tymolondon.com/uploads/1/3/0/6/130621983/baxunibanagiwog-vurus-nagej-ruvarelam.pdf
    • http://photospedition.com/uploads/1/3/0/3/130313700/637755.pdf
    • http://mta-sts.mail.frankechenhofer.com/uploads/1/3/0/2/130271063/c4c4394.pdf
    • http://atelierkunstzaken.nl/uploads/1/3/0/4/130488220/3730988.pdf
    • http://www.assoformitalia.com/uploads/1/3/0/4/130476427/pokukavufiwukegokupe.pdf
    • http://eddyinnovativesolutions.com/uploads/1/3/0/4/130435985/4fcfe8f7391.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000074ae.bin
e919d7b38d9a41bbb343d531c14a77270b0c5d78b26da96534d25036f2bf1144		 pdf-font-stream PDF embedded font (sfnt) at offset 0x74AE 7580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.